On Thu, 2 Apr 2026 00:03:15 +0800
Pengpeng Hou <[email protected]> wrote:
> parse_probe_arg() accepts quoted immediate strings and passes the body
> after the opening quote to __parse_imm_string(). That helper currently
> computes strlen(str) and immediately dereferences str[len - 1], which
> underflows when the body is empty.
>
> Reject empty immediate strings before checking for the closing quote.
>
Oops, good catch!
Let me pick it.
Thank you!
> Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support")
> Signed-off-by: Pengpeng Hou <[email protected]>
> ---
> Changes since v1:
> - resend as a standalone patch instead of part of an accidental
> cross-subsystem 1/4 series
>
> kernel/trace/trace_probe.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
> index e0a5dc86c07e..e1c73065dae5 100644
> --- a/kernel/trace/trace_probe.c
> +++ b/kernel/trace/trace_probe.c
> @@ -1068,7 +1068,7 @@ static int __parse_imm_string(char *str, char **pbuf,
> int offs)
> {
> size_t len = strlen(str);
>
> - if (str[len - 1] != '"') {
> + if (!len || str[len - 1] != '"') {
> trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE);
> return -EINVAL;
> }
> --
> 2.50.1 (Apple Git-155)
>
--
Masami Hiramatsu (Google) <[email protected]>
